lkml.org 
[lkml]   [2019]   [Jan]   [21]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.20 086/111] sctp: allocate sctp_sockaddr_entry with kzalloc
    Date
    4.20-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Xin Long <lucien.xin@gmail.com>

    commit 400b8b9a2a17918f8ce00786f596f530e7f30d50 upstream.

    The similar issue as fixed in Commit 4a2eb0c37b47 ("sctp: initialize
    sin6_flowinfo for ipv6 addrs in sctp_inet6addr_event") also exists
    in sctp_inetaddr_event, as Alexander noticed.

    To fix it, allocate sctp_sockaddr_entry with kzalloc for both sctp
    ipv4 and ipv6 addresses, as does in sctp_v4/6_copy_addrlist().

    Reported-by: Alexander Potapenko <glider@google.com>
    Signed-off-by: Xin Long <lucien.xin@gmail.com>
    Reported-by: syzbot+ae0c70c0c2d40c51bb92@syzkaller.appspotmail.com
    Acked-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
    Acked-by: Neil Horman <nhorman@tuxdriver.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    net/sctp/ipv6.c | 5 +----
    net/sctp/protocol.c | 4 +---
    2 files changed, 2 insertions(+), 7 deletions(-)

    --- a/net/sctp/ipv6.c
    +++ b/net/sctp/ipv6.c
    @@ -97,11 +97,9 @@ static int sctp_inet6addr_event(struct n

    switch (ev) {
    case NETDEV_UP:
    - addr = kmalloc(sizeof(struct sctp_sockaddr_entry), GFP_ATOMIC);
    + addr = kzalloc(sizeof(*addr), GFP_ATOMIC);
    if (addr) {
    addr->a.v6.sin6_family = AF_INET6;
    - addr->a.v6.sin6_port = 0;
    - addr->a.v6.sin6_flowinfo = 0;
    addr->a.v6.sin6_addr = ifa->addr;
    addr->a.v6.sin6_scope_id = ifa->idev->dev->ifindex;
    addr->valid = 1;
    @@ -431,7 +429,6 @@ static void sctp_v6_copy_addrlist(struct
    addr = kzalloc(sizeof(*addr), GFP_ATOMIC);
    if (addr) {
    addr->a.v6.sin6_family = AF_INET6;
    - addr->a.v6.sin6_port = 0;
    addr->a.v6.sin6_addr = ifp->addr;
    addr->a.v6.sin6_scope_id = dev->ifindex;
    addr->valid = 1;
    --- a/net/sctp/protocol.c
    +++ b/net/sctp/protocol.c
    @@ -101,7 +101,6 @@ static void sctp_v4_copy_addrlist(struct
    addr = kzalloc(sizeof(*addr), GFP_ATOMIC);
    if (addr) {
    addr->a.v4.sin_family = AF_INET;
    - addr->a.v4.sin_port = 0;
    addr->a.v4.sin_addr.s_addr = ifa->ifa_local;
    addr->valid = 1;
    INIT_LIST_HEAD(&addr->list);
    @@ -776,10 +775,9 @@ static int sctp_inetaddr_event(struct no

    switch (ev) {
    case NETDEV_UP:
    - addr = kmalloc(sizeof(struct sctp_sockaddr_entry), GFP_ATOMIC);
    + addr = kzalloc(sizeof(*addr), GFP_ATOMIC);
    if (addr) {
    addr->a.v4.sin_family = AF_INET;
    - addr->a.v4.sin_port = 0;
    addr->a.v4.sin_addr.s_addr = ifa->ifa_local;
    addr->valid = 1;
    spin_lock_bh(&net->sctp.local_addr_lock);

    \
     
     \ /
      Last update: 2019-01-21 15:17    [W:4.045 / U:0.020 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site